Glpi Project

By the Year

In 2026 there have been 38 vulnerabilities in Glpi Project with an average score of 6.7 out of ten. Last year, in 2025 Glpi Project had 21 security vulnerabilities published. That is, 17 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.02.

Recent Glpi Project Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-53629	Sep 25, 2026	GLPI SQLi via history tab URL in 9.4.0-10.0.26 / 11.0.8 (fixed) GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.	Glpi
CVE-2026-53626	Sep 25, 2026	GLPI 11.0.5-11.0.7 Permission Logic Bypass Exposing Docs GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.	Glpi
CVE-2026-48482	Sep 25, 2026	GLPI 11.0.0-11.0.8 Directory Traversal & Remote Code Exec via Form Import GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.	Glpi
CVE-2026-53625	Sep 25, 2026	GLPI API AuthType Manipulation Enables Account Takeover (10.0.26/11.0.8) GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. This issue is fixed in versions 11.0.8 and 10.0.26.	Glpi
CVE-2026-53610	Sep 25, 2026	GLPI <11.0.8 XSS via Crafted Dashboard URL Reflected Attack GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. This issue is fixed in version 11.0.8.	Glpi
CVE-2026-47679	Sep 25, 2026	GLPI <=10.0.26 & <=11.0.8 pathvalidation allows file deletion GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.	Glpi
CVE-2026-55214	Sep 25, 2026	GLPI 11.0.6-11.0.8 Stored XSS via supplier website field GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.	Glpi
CVE-2026-49470	Sep 25, 2026	GLPI 11.0.0-11.0.8 MFA TOTP brute force via unsanitized verification endpoint GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8.	Glpi
CVE-2026-55217	Sep 25, 2026	GLPI <=10.0.26/11.0.8: Auth. users can modify KB comments/translations GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.	Glpi
CVE-2026-53628	Sep 25, 2026	GLPI 10.0.26/11.0.8: Auth Escalation via Disabled 2FA for External Users GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.	Glpi
CVE-2026-45801	Sep 25, 2026	GLPI Debug Mode Privilege Escalation before 10.0.26/11.0.8 GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26.	Glpi
CVE-2026-53627	Sep 25, 2026	GLPI API v2 Low-Priv Auth Update Bypass <=11.0.8 GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.	Glpi
CVE-2026-49469	Sep 25, 2026	LDAP Filter Bypass via User Import in GLPI <11.0.8 GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.	Glpi
CVE-2026-53987	Jul 09, 2026	GLPI 11 Tag Plug 2.14.4 XSS via Unsanitized Tag Name The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.	Glpi
CVE-2026-13490	Jun 28, 2026	GLPI <11.0.8 Doc Handler auth bypass via docid in front/document.send.php A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to authorization bypass. The attack can be executed remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure.	Glpi
CVE-2026-42321	Jun 03, 2026	GLPI 10.0.4-10.0.24 XSS Asset Locked Tab GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. Upgrade to 10.0.25 or 11.0.7 to receive a patch.	Glpi
CVE-2026-42320	Jun 03, 2026	GLPI Arbitrary File Read in GLPI_DOC_DIR (v0.50 <10.0.25/11.0.7) GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside the GLPI_DOC_DIR. Upgrade to 10.0.25 or 11.0.7 to receive a patch.	Glpi
CVE-2026-42318	Jun 03, 2026	GLPI <=10.0.24: Low-Priv Planning Deletion PrivEsc GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User's planning.	Glpi
CVE-2026-42317	Jun 03, 2026	GLPI <10.0.25/11.0.7 Arbitrary File Deletion via Technician Access GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch.	Glpi
CVE-2026-44281	Jun 03, 2026	GLPI 10.0.25 Authenticated Asset Read via Config READ GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permission can read a specific asset object. Upgrade to 11.0.7 or 10.0.25 to receive a patch.	Glpi
CVE-2026-40108	Jun 02, 2026	GLPI <=11.0.6 Stored XSS in ITIL Costs (fixed 11.0.7) GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XSS payload in a ITIL costs. This issue has been fixed in version 11.0.7.	Glpi
CVE-2026-5385	Jun 02, 2026	GLPI < 11.0.7: Unauth Write Access to KB Allows XSS An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. This issue affects glpi: before 11.0.7.	Glpi
CVE-2026-32312	May 18, 2026	GLPI <11.0.7: Authenticated Form Export Disclosure via Forms READ GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue has been fixed in version 11.0.7.	Glpi
CVE-2026-29047	Apr 06, 2026	GLPI SQL injection via Log Export pre-10.0.24/11.0.6 GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export feature. This vulnerability is fixed in 10.0.24 and 11.0.6.	Glpi
CVE-2026-26263	Apr 06, 2026	GLPI 11.0.0-11.0.5 Blind SQLi in Search Engine GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6.	Glpi
CVE-2026-26027	Apr 06, 2026	GLPI 11.0.0-11.0.5 Inventory XSS Fixed in 11.0.6 GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.	Glpi
CVE-2026-26026	Apr 06, 2026	GLPI 11.0.0-11.0.5 RCE via admin template injection GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.	Glpi
CVE-2026-25932	Apr 06, 2026	GLPI XSS via Supplier Field, Auth, Fixed in 10.0.24 GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.	Glpi
CVE-2026-26001	Mar 17, 2026	GLPI Inventory Plugin <=1.6.5 SQLi via unsanitized report input The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.	Glpi
CVE-2026-25937	Mar 17, 2026	GLPI MFA Bypass v11.0.0-11.0.5 (Fix in 11.0.6) GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.	Glpi
CVE-2026-25936	Mar 17, 2026	GLPI <11.0.6 Authenticated SQLi GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue.	Glpi
CVE-2026-22248	Mar 11, 2026	GLPI 11.0.0-11.0.4 PHP File Upload Execution (pre-11.0.5) GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.	Glpi
CVE-2026-25590	Mar 03, 2026	GLPI Inventory Plugin 1.6.6 Reflected XSS in Task Jobs (Before 1.6.6) The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected XSS vulnerability in task jobs. This vulnerability is fixed in 1.6.6.	Glpi
CVE-2026-22044	Feb 04, 2026	GLPI 0.8510.0.23 Authenticated SQL Injection GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23.	Glpi
CVE-2026-23624	Feb 04, 2026	GLPI SSO session hijacking in v0.71-10.0.23/11.0.5 GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .	Glpi
CVE-2026-22247	Feb 04, 2026	GLPI SSRF via Webhook before 11.0.5 GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5.	Glpi
CVE-2025-66417	Jan 15, 2026	GLPI 11.0.0-11.0.3 SQLi via inventory endpoint (unauthenticated) GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 11.0.3.	Glpi
CVE-2025-64516	Jan 15, 2026	GLPI Unauthorized Document Access Pre 10.0.21/11.0.3 GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.	Glpi
CVE-2023-53943	Dec 18, 2025	GLPI 9.5.7 Username enumeration via password reset GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers can systematically test email addresses by submitting requests to the password reset endpoint and analyzing response differences to identify valid user accounts.	Glpi
CVE-2025-64520	Dec 16, 2025	GLPI 9.1.0-<10.0.21: API Exposes Knowledge Base (CVE-2025-64520) GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.	Glpi
CVE-2025-59935	Dec 16, 2025	GLPI 10.0.0-10.0.20 XSS via Inventory Endpoint before 10.0.21 GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch.	Glpi
CVE-2025-32786	Nov 04, 2025	GLPI Inventory Plugin <=1.5.0 SQL Injection (fixed 1.5.1) The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to SQL Injection. This issue is fixed in version 1.5.1.	Glpi
CVE-2025-53357	Jul 30, 2025	GLPI Privilege Escalation: Alter Reservations 0.78-10.0.18 (Fixed 10.0.19) GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.78 through 10.0.18, a connected user can alter the reservations of another user. This is fixed in version 10.0.19.	Glpi
CVE-2025-53113	Jul 30, 2025	GLPI 0.65-10.0.18 External Links Info Disclosure (fixed 10.0.19) GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the external links feature to fetch information on items they do not have the right to see. This is fixed in version 10.0.19.	Glpi
CVE-2025-53112	Jul 30, 2025	GLPI 9.1-10.0.18 Permission Check RCE GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.19.	Glpi
CVE-2025-53111	Jul 30, 2025	GLPI 0.80-10.0.18 Unauth Access (CVE-2025-53111) GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unauthorized access to some resources. This is fixed in version 10.0.19.	Glpi
CVE-2025-53008	Jul 30, 2025	Credential Theft via Malicious Payload in GLPI 9.3.1-10.0.19 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.3.1 through 10.0.19, a connected user can use a malicious payload to steal mail receiver credentials. This is fixed in version 10.0.19.	Glpi
CVE-2025-52567	Jul 30, 2025	GLPI <10.0.19 SSRF in RSS/External Calendar Planning (CVE-2025-52567) GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 through 10.0.18, usage of RSS feeds or external calendars when planning is subject to SSRF exploit. The previous security patches provided since GLPI 10.0.4 were not robust enough for certain specific cases. This is fixed in version 10.0.19.	Glpi
CVE-2025-52897	Jul 30, 2025	GLPI 10.0.18 Planning Feature XSS/Phishing Vulnerability GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19.	Glpi
CVE-2025-27514	Jul 29, 2025	GLPI <=10.0.18 Stored XSS Kanban (fixed 10.0.19) GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19.	Glpi